How to know if a file is a hardlink file ?

NTFSD
1

When kernel creates a hardlink file, it send a IRP_MJ_SET_INFORMATION
with FileLinkInformation

When I catch IRP_MJ_CLEANUP or IRP_MJ_CLOSE, is it possible to know if
the file objet is a “hard link” ?
There is a attribute in PFILE_OBJECT for this purpose or in another
internal structures ?

Of course, I can catch IRP_MJ_SET_INFORMATION/FileLinkInformation and
set a flag in my internal data.
But this flag perhaps already exists in kernel ?

thanks in advanced

2

You can establish how many links there are to a file by sending a
FileStandardInformation IRP_MJ_QUERY_INFORMATION.

However, depending on what you are needing to achieve, you may be in for
significantly more work involving capturing the name by which a file is
opened, and listening to rename (and filling the timing window between these
two).

“pfml” wrote in message news:xxxxx@ntfsd…
> When kernel creates a hardlink file, it send a IRP_MJ_SET_INFORMATION with
> FileLinkInformation
>
> When I catch IRP_MJ_CLEANUP or IRP_MJ_CLOSE, is it possible to know if the
> file objet is a “hard link” ?
> There is a attribute in PFILE_OBJECT for this purpose or in another
> internal structures ?
>
> Of course, I can catch IRP_MJ_SET_INFORMATION/FileLinkInformation and set
> a flag in my internal data.
> But this flag perhaps already exists in kernel ?
>
> thanks in advanced
>
>
>

3

As Rod said, you can capture when a hardlink is created by monitoring
IRP_MJ_SET_INFORMATION with FileLinkInformation. But you would have to keep
track of that in your own context.

How useful that is depends on what you want to do. If you want to prevent
the hardlink, stop it in IRP_MJ_SET_INFORMATION.

If you want to just detect files with multiple links for some reason (like
avoiding duplication during backup), that could be tougher. Suppose the
hardlink was created months ago? Or suppose a file has 30 hardlinks on it?

There is no difference between the “original” file and the file created with
a hardlink. They are simply directory entries to the same file. And given
a file with multiple links, there’s no way to find all the links without
searching the file system and comparing the file id of each file.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rod Widdowson
Sent: Monday, September 25, 2006 5:54 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How to know if a file is a hardlink file ?

You can establish how many links there are to a file by sending a
FileStandardInformation IRP_MJ_QUERY_INFORMATION.

However, depending on what you are needing to achieve, you may be in for
significantly more work involving capturing the name by which a file is
opened, and listening to rename (and filling the timing window between these

two).

“pfml” wrote in message news:xxxxx@ntfsd…
> When kernel creates a hardlink file, it send a IRP_MJ_SET_INFORMATION with

> FileLinkInformation
>
> When I catch IRP_MJ_CLEANUP or IRP_MJ_CLOSE, is it possible to know if the

> file objet is a “hard link” ?
> There is a attribute in PFILE_OBJECT for this purpose or in another
> internal structures ?
>
> Of course, I can catch IRP_MJ_SET_INFORMATION/FileLinkInformation and set
> a flag in my internal data.
> But this flag perhaps already exists in kernel ?
>
> thanks in advanced
>
>
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Ken Cross a écrit :

As Rod said, you can capture when a hardlink is created by monitoring
IRP_MJ_SET_INFORMATION with FileLinkInformation. But you would have to keep
track of that in your own context.

How useful that is depends on what you want to do. If you want to prevent
the hardlink, stop it in IRP_MJ_SET_INFORMATION.

If you want to just detect files with multiple links for some reason (like
avoiding duplication during backup), that could be tougher. Suppose the
hardlink was created months ago? Or suppose a file has 30 hardlinks on it?

There is no difference between the “original” file and the file created with
a hardlink. They are simply directory entries to the same file. And given
a file with multiple links, there’s no way to find all the links without
searching the file system and comparing the file id of each file.

Ken

Thank Ken & Rod

I try the IRP_MJ_QUERY_INFORMATION/FileStandardInformation
/NumberOfLinks solution

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rod Widdowson
Sent: Monday, September 25, 2006 5:54 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How to know if a file is a hardlink file ?

You can establish how many links there are to a file by sending a
FileStandardInformation IRP_MJ_QUERY_INFORMATION.

However, depending on what you are needing to achieve, you may be in for
significantly more work involving capturing the name by which a file is
opened, and listening to rename (and filling the timing window between these

two).

“pfml” wrote in message news:xxxxx@ntfsd…
>
>> When kernel creates a hardlink file, it send a IRP_MJ_SET_INFORMATION with
>>
>
>
>> FileLinkInformation
>>
>> When I catch IRP_MJ_CLEANUP or IRP_MJ_CLOSE, is it possible to know if the
>>
>
>
>> file objet is a “hard link” ?
>> There is a attribute in PFILE_OBJECT for this purpose or in another
>> internal structures ?
>>
>> Of course, I can catch IRP_MJ_SET_INFORMATION/FileLinkInformation and set
>> a flag in my internal data.
>> But this flag perhaps already exists in kernel ?
>>
>> thanks in advanced
>>
>>
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@imecom.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>